MAL-2026-18581: Malicious code in hijuko-pilara (PyPI)

Published Nov 3, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (3e03de70d14b6b6e3965178f06a73eecdd7197978d8363aaa7c83cf8f3d32696) The package uses fake http-downloaded dependencies to track downloads, and has no other purpose.

---

Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2026-10-vacsdk

Reasons (based on the campaign):

- dependency-confusion

Affected Software

1 affected component

pip/hijuko-pilara=1.0.0

Event History

Nov 3, 2026

Advisory Published

via OSV·08:19 PM

Data Sourced

via OSV·08:19 PM

DescriptionAffected Software

Frequently Asked Questions

What behavior makes this package suspicious?

It uses fake dependencies that are downloaded over HTTP to track downloads and is reported to have no other purpose.

What type of supply-chain risk is associated with this package?

The reported campaign reason is dependency confusion, meaning environments that resolve package names from unintended sources may be at risk.

Is this reported as a high-harm payload?

The source categorizes it as probably pentest and describes clearly low-harm possibilities, but it is still identified as malicious due to its fake HTTP-downloaded dependency behavior and download tracking.

MAL-2026-18581: Malicious code in hijuko-pilara (PyPI)

Affected Software

Event History

Frequently Asked Questions

What behavior makes this package suspicious?

What type of supply-chain risk is associated with this package?

Is this reported as a high-harm payload?

Company

Resources

Contact

Frequently Asked Questions

What behavior makes this package suspicious?

What type of supply-chain risk is associated with this package?

Is this reported as a high-harm payload?